Ledger Probes CryptoBilis Reseller Breach, Warns of $86M in Suspected Theft

Hardware wallet manufacturer Ledger is investigating reports of cryptocurrency losses tied to authorized Southeast Asian reseller CryptoBilis, urging affected users in Indonesia, Malaysia, and the Philippines to migrate their assets to new devices. In a statement on X, Ledger said it instructed CryptoBilis to suspend sales and shipments as a precaution, advising customers who purchased devices within the past 90 days not to initialize them. Users who already activated their wallets were told to transfer holdings to a freshly generated Ledger signer with a new recovery phrase. The company emphasized that no incidents have been reported from devices purchased directly through its own channels.

Ledger has not disclosed the number of affected customers, the estimated value of losses, or the root cause of the incidents, and has not confirmed whether the devices themselves were tampered with. Separately, onchain researchers have identified suspected thefts that may be connected. Researcher tanuki42 flagged eight wallet addresses allegedly linked to more than $72 million in losses, while Specter estimated over $86 million stolen across Bitcoin, Ethereum, and Tron. Crypto security organization Security Alliance (SEAL) amplified tanuki42's findings and directed victims to its incident-response team, though SEAL did not provide an independent loss estimate or identify a cause.

Ledger reiterated that its infrastructure, systems, and services were not compromised and described the incident as isolated to the reseller and its regional market. The investigation remains ongoing as both Ledger and independent researchers work to determine whether the CryptoBilis devices were physically manipulated prior to distribution or whether customers were targeted through other means. The episode underscores the persistent supply-chain risks facing hardware wallet users, even when purchasing from officially authorized resellers.